Insurgent Ventures II A/S (“IV”), CVR 43070320 (“we” or “us”), operates www.strompouches.se (the
“Site”). The Site is intended solely as a platform for our customers and contains information about
our products, events and promotions. This Privacy Policy applies to you if you purchase products,
provide services from us, participate in our events or promotions, including visiting our websites or
interacting with us via social media, and describes how we process personal data in connection with
the use of the Site. If you are an existing customer of ours, further details about how we use your
personal data may be set out in your contract with us.

Which personal data and why?

In order to view information on our products and promotions, and to order products on the Site, you
must at least register with your name, address, e-mail address, phone number (contact information)
and payment details used to purchase our products and services, such as credit/debit card number
and expiry date. We also collect details of your marketing and communication preferences and
information to help us determine what products may be of interest to you.
When you visit the Site, we collect technical information about your IP address. Note that certain
other companies than IV also collect your IP address when you visit the Site, in connection with the
use of third-party cookies. How this occurs, and how you can go about limiting or turning off cookies
in your web browser, is described in our cookie policy.

We will use your personal data for the following purposes: To provide you with the information
and marketing materials on our products, to run our promotions, to complete your order and deliver
our products, including shipping the products to you, and to notify you about changes to our
products and services.

We may also process personal data to comply with applicable data protection rules, compliance with
e-commerce laws and our legitimate interests, such as documentation, implementing and
maintaining technical and organizational security measures, handling requests and complaints from
you and others, investigating and reporting suspected security breaches in order to establish,
enforce or defend legal claims, handling inspections and requests from regulatory authorities,
handling disputes with you and third parties, preventing misuse and in having a properly functioning
Site, and analyzing sales statistics to improve our marketing and sales efforts.

The purposes of us processing your IP address are to be able to provide to prevent infringements,
incidents and other misuse of our services on the Site, to run statistics on users to the Site and to
update and improve the Site.

Our legal basis for this processing is to ensure (i) the performance of the contract with you; (ii) our
or third party legitimate interests provided, however, that it is necessary for these purposes and
those interests are not overridden by the interests and fundamental rights and freedoms of data
subject which require personal data protection; (iii) our legal obligation we are subject to. The legal
basis for processing of your personal data for direct marketing purposes is based on (iv) your
consent that has been given to us.

How long do we save your data?

We save your IP-address and other personal data as stated above for the time necessary for the
purposes described above.

We may also save your personal data for a longer time, if it is necessary to fulfill a legal obligation
that requires processing in accordance with applicable laws, or so that we can establish, enforce, or
defend legal claims.

Who do we share your personal data with?

IV may share your personal data with other companies within the Scandinavian Tobacco Group
(“STG”) of companies, as well as with collaborating partners, for example when providing IT services.
These recipients only process your personal data on our behalf and in accordance with our
instructions. IV takes all appropriate legal, technological and organizational measures to ensure that
your personal data is processed securely, and with an adequate level of security when transferring
to, or sharing with, selected recipients of this kind.

IV may share your personal data with government agencies if we are obligated under the law to do
so, or on suspicion of criminal activity.

Where do we process your personal data?

Your personal data will primarily be processed within the EU/EEA, but may also be transferred to a
country outside the EU/EEA, such as the United States, for example, if we share your information
with other companies in the STG group of companies.

IV will only transfer your personal data to a country outside the EU/EEA if there are legal grounds to
do so and sufficient guarantees that your personal data will be handled in a lawful manner. In such
cases, IV takes all appropriate legal, technological and organizational measures to ensure that your
personal data is processed securely, and with an adequate level of security comparable to the level
of protection offered within the EU/EEA .

How do we protect your personal data?

IV takes the security measures needed to protect your personal data.

What are your rights?

You have certain specific legal rights that you can enforce against us. A summary of these rights
follows below.

Right to access/extracts from the register. You have the right to know what personal data about
you we are processing. Upon request from you, we will provide you with information in writing
about our processing of your personal data.

Right to data portability. You have the right to request a copy of the personal data you have
provided to us in a structured, commonly used and machine-readable format. Provided that it is
technologically possible – which is determined by IV – you also have the right to request that we
transfer this personal data to another controller. The right to data portability applies to personal
data that is processed via automated means and is based on a contract with you or your consent.

Correction of erroneous information. You have the right to request that we correct erroneous or
incomplete information about yourself.

Deletion of certain data. You have the right to request that we delete your personal data under
certain conditions, for example if your personal data is no longer necessary for the purpose for
which we collected the data, if the processing is based on your consent and you have withdrawn
such consent, if you object to a weighing of legitimate interests we have carried out and support for
our legitimate interest is lacking, if your personal data was processed in an unlawful manner or if
your personal data has to be deleted in order to fulfill a legal obligation.

In certain cases, we must save your personal data despite your request owing to legal requirements
such as accounting and tax legislation, or for example if we need to retain certain data in order to
establish, enforce or defend a legal claim.

Right to restrict processing of your personal data. You have the right to demand a restriction on our
processing of your personal data in certain cases. If, for example, you have contested the fact that
your personal data is correct, you can request a restriction on processing for a period of time that
will give us the opportunity to check if your personal data is correct.

Right to object to our processing of personal data. You have the right, under certain conditions, to
object to our processing of your personal data.

You have the right at any time to object to processing of your personal data for direct marketing
purposes, including profiling related to such marketing. You can exercise your right to prevent such
processing by checking certain boxes on the forms we use to collect your data or clicking
unsubscribe at the bottom of the emails we send to you for marketing purposes.

You have the right to object to processing that is based on the legal grounds of our legitimate
interest. However, we may continue processing your data despite your objection to the processing if
we have compelling legitimate reasons for the processing that outweigh your privacy interests.

Contact and questions

If you have any questions regarding our processing of your personal data, or if you would like to
present a request about an excerpt from the registry, data portability, correction or deletion – or
present an objection or a restriction – please contact us at:

Insurgent Ventures II A/S
Sandtoften 9
DK-2820 Gentofte
Denmark
E-mail: mydata@st-group.com
Telephone: +45 39 55 62 00

Complaints

If you have a complaint regarding IV’s processing of your personal data, you have the right to submit
such complaints to

Integritetsskyddsmyndigheten
Box 8114
104 20 Stockholm
Sweden
E-mail: imy@imy.se
Phone number: +46 (0)8 657 61 00
Latest update: 1 July 2022